Threat intelligence / Malware

SUPERNOVA

[SUPERNOVA](https://attack.mitre.org/software/S0578) is an in-memory web shell written in .NET C#. It was discovered in November 2020 during the investigation of [APT29](https://attack.mitre.org/groups/G0016)'s SolarWinds cyber operation but determined to be unrelated. Subsequent analysis suggests [SUPERNOVA](https://attack.mitre.org/software/S0578) may have been used by the China-based threat group SPIRAL.(Citation: Guidepoint SUPERNOVA Dec 2020)(Citation: Unit42 SUPERNOVA Dec 2020)(Citation: SolarWinds Advisory Dec 2020)(Citation: CISA Supernova Jan 2021)(Citation: Microsoft Analyzing Solorigate Dec 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

5 recorded

Relationships

uses

to Encrypted/Encoded File

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Web Protocols

Technique

uses

to Web Shell

Technique

6 external

References

mitre-attack

S0578

open

CISA Supernova Jan 2021

https://us-cert.cisa.gov/ncas/analysis-reports/ar21-027a

open

Microsoft Analyzing Solorigate Dec 2020

https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

open

Guidepoint SUPERNOVA Dec 2020

https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/

open

SolarWinds Advisory Dec 2020

https://www.solarwinds.com/sa-overview/securityadvisory

open

Unit42 SUPERNOVA Dec 2020

https://unit42.paloaltonetworks.com/solarstorm-supernova/

open